ASLR Makes Vista A Moving Target

Microsoft added new memory technology, Address Space Layout Randomization (ASLR), to Windows Vista Beta 2 that aims to make some types of attacks much harder to accomplish.

Writing in his blog, Michael Howard, senior security program manager at Microsoft, said that ASLR causes Vista to load system code randomly into one of 256 different memory locations, which makes it harder for intruders to launch certain types of exploits that depend on knowing the address location of system calls.

Howard said in his blog that ASLR "is not a panacea, it is not a replacement for insecure code, but when used in conjunction with other technologies \[...\] it is a useful defense because it makes Windows systems look different to malware, making automated attacks harder."

"We added ASLR \[to Vista\] pretty late in the game, but we decided that adding it to Beta 2 and enabling it by default was important so we can understand how well it performs in the field, \[...\] what the compatibility implications are, and to give us time to fine tune ASLR before we finally release Windows Vista," said Howard.

He went on to say that the combination of ASLR and Data Execution Prevention (DEP), as well as features found in Visual C++ such as the stack-based buffer overun detection and exception handling options, together raise the security bar in Windows Vista.